« Volver al listado

CVE-2026-81525

Estado: AnalizadaAlta (8.6)—

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CVE de inyección en identificadores de espacio de nombres MongoDB (CWE-943), con PR:L requiere autenticación remota previa. Acceso remoto a base de datos (T1210). El atacante redirige operaciones a ubicaciones distintas: manipulación de datos (T1565.002) y lectura no autorizada (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationEncrypt Sensitive InformationDisable or Remove Feature or Program

Tecnologías afectadas (2)

Mongodb — PHP DriverMongodb — PHP Library

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-81525",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-81525",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-28T15:48:47.805241Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@mongodb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@mongodb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@mongodb.com",
      "affectedData": [
        {
          "vendor": "MongoDB",
          "product": "PHP Library",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.21.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.4.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "MongoDB",
          "product": "PHP Extension",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.21.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.4.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-27T20:18:50.913",
  "references": [
    {
      "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://jira.mongodb.org/browse/PHPLIB-1927",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@mongodb.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@mongodb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended."
    }
  ],
  "lastModified": "2026-09-29T19:17:04.850",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7119CCA6-A7EB-479D-A8DD-BB113E716270",
              "versionEndExcluding": "1.21.6"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31E27BE9-0F03-4575-A410-03D44EC2EB6A",
              "versionEndExcluding": "2.4.1",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:php_library:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01866C7B-FB73-48D4-BC21-20AEF754D2C5",
              "versionEndExcluding": "1.21.4"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:php_library:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B6C06A6-B674-47E0-8CC0-AE688075AB99",
              "versionEndExcluding": "2.4.1",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@mongodb.com"
}